{ pkgs, lib, ... }: { imports = [ ../../nixos/profiles/dnscrypt-proxy2.nix ../../nixos/profiles/networking/ssh.nix networking/nftables.nix ]; install.substituteOnDestination = false; networking.nftables.ruleset = lib.mkAfter '' table inet filter { chain input { ip daddr 10.0.0.0/8 counter goto input-lan ip daddr 172.16.0.0/12 counter goto input-lan ip daddr 192.168.0.0/16 counter goto input-lan ip daddr 224.0.0.0/3 counter goto input-lan goto input-net } chain output { ip daddr 10.0.0.0/8 counter goto output-lan ip daddr 172.16.0.0/12 counter goto output-lan ip daddr 192.168.0.0/16 counter goto output-lan ip daddr 224.0.0.0/3 counter goto output-lan jump output-net log level warn prefix "output-net: " counter drop } } ''; networking.networkmanager.enable = true; services.avahi.enable = true; services.openssh.settings.X11Forwarding = true; services.vnstat.enable = true; systemd.services.sshd.serviceConfig.LoadCredentialEncrypted = [ "host.key:${ssh/host.key.cred}" ]; }